diff --git a/hdf5-LD_LIBRARY_PATH.patch b/hdf5-LD_LIBRARY_PATH.patch
index f34ea69..e4025c1 100644
--- a/hdf5-LD_LIBRARY_PATH.patch
+++ b/hdf5-LD_LIBRARY_PATH.patch
@@ -1,20 +1,28 @@
-diff -up hdf5-1.8.10/configure.LD_LIBRARY_PATH hdf5-1.8.10/configure
---- hdf5-1.8.10/configure.LD_LIBRARY_PATH	2012-10-26 18:14:59.000000000 -0600
-+++ hdf5-1.8.10/configure	2012-11-14 08:56:52.695024834 -0700
-@@ -27496,9 +27496,6 @@ if ${hdf5_cv_printf_ll+:} false; then :
-   $as_echo_n "(cached) " >&6
- else
- 
+--- hdf5-1.8.12/configure.ac.LD_LIBRARY_PATH	2015-03-04 13:20:53.164831682 -0700
++++ hdf5-1.8.12/configure.ac	2015-03-04 13:23:17.852904172 -0700
+@@ -2342,14 +2342,9 @@
+ ## Try to figure out how to print `long long'.  Some machines use `%lld'
+ ## and others use `%qd'.  There may be more!  The final `l' is a
+ ## default in case none of the others work.
+-## Need to patch up LD_LIBRARY_PATH so that the execution can find all
+-## the dynamic library.  The correct way to do it should be updating
+-## LD_LIBRARY_PATH along with LDFLAGS or do it with the AC_TRY_RUN macro.
+ ##
+ AC_MSG_CHECKING([how to print long long])
+ AC_CACHE_VAL([hdf5_cv_printf_ll], [
 -LD_LIBRARY_PATH="$LD_LIBRARY_PATH`echo $AM_LDFLAGS $LDFLAGS | sed -e 's/-L/:/g' -e 's/ //g'`"
 -export LD_LIBRARY_PATH
--
+ 
  for hdf5_cv_printf_ll in l ll L q unknown; do
-    if test "$cross_compiling" = yes; then :
-   continue
-diff -up hdf5-1.8.10/src/Makefile.in.LD_LIBRARY_PATH hdf5-1.8.10/src/Makefile.in
---- hdf5-1.8.10/src/Makefile.in.LD_LIBRARY_PATH	2012-10-26 18:14:55.000000000 -0600
-+++ hdf5-1.8.10/src/Makefile.in	2012-11-14 08:55:35.197476914 -0700
-@@ -1327,8 +1327,6 @@ help:
+    AC_TRY_RUN([
+--- hdf5-1.8.12/src/Makefile.am.LD_LIBRARY_PATH	2013-11-21 08:13:52.000000000 -0700
++++ hdf5-1.8.12/src/Makefile.am	2015-03-04 13:22:19.355266916 -0700
+@@ -122,25 +122,17 @@
+ settings_DATA=libhdf5.settings
+ 
+ # Number format detection
+-# The LD_LIBRARY_PATH setting is a kludge.
+-# Things should have been all set during H5detect making.
  # Remove the generated .c file if errors occur unless HDF5_Make_Ignore
  # is set to ignore the error.
  H5Tinit.c: H5detect$(EXEEXT)
@@ -23,7 +31,10 @@ diff -up hdf5-1.8.10/src/Makefile.in.LD_LIBRARY_PATH hdf5-1.8.10/src/Makefile.in
  	$(RUNSERIAL) ./H5detect$(EXEEXT) > $@  ||                               \
  	    (test $$HDF5_Make_Ignore && echo "*** Error ignored") ||          \
  	    ($(RM) $@ ; exit 1)
-@@ -1339,8 +1337,6 @@ H5Tinit.c: H5detect$(EXEEXT)
+ 
+ # Build configuration header file generation
+-# The LD_LIBRARY_PATH setting is a kludge.
+-# Things should have been all set during H5make_libsettings making.
  # Remove the generated .c file if errors occur unless HDF5_Make_Ignore
  # is set to ignore the error.
  H5lib_settings.c: H5make_libsettings$(EXEEXT) libhdf5.settings
diff --git a/hdf5-wrappers.patch b/hdf5-wrappers.patch
new file mode 100644
index 0000000..bcda52d
--- /dev/null
+++ b/hdf5-wrappers.patch
@@ -0,0 +1,109 @@
+diff -up hdf5-1.8.12/c++/src/h5c++.in.wrappers hdf5-1.8.12/c++/src/h5c++.in
+--- hdf5-1.8.12/c++/src/h5c++.in.wrappers	2013-11-21 08:14:01.000000000 -0700
++++ hdf5-1.8.12/c++/src/h5c++.in	2021-09-15 20:14:40.123641057 -0600
+@@ -89,10 +89,10 @@ CXXLINKERBASE="@CXX@"
+ # paths and libraries from AM_LDFLAGS, LDFLAGS, AM_LIBS or LIBS carried in
+ # from the hdf5 build. The order of the flags is intended to give precedence
+ # to the user's flags.
+-H5BLD_CXXFLAGS="@AM_CXXFLAGS@ @CXXFLAGS@"
++H5BLD_CXXFLAGS=
+ H5BLD_CPPFLAGS="@AM_CPPFLAGS@ @CPPFLAGS@"
+-H5BLD_LDFLAGS="@AM_LDFLAGS@ @LDFLAGS@"
+-H5BLD_LIBS="@LIBS@"
++H5BLD_LDFLAGS=
++H5BLD_LIBS=
+ 
+ CXX="${HDF5_CXX:-$CXXBASE}"
+ CXXLINKER="${HDF5_CLINKER:-$CXXLINKERBASE}"
+@@ -105,7 +105,8 @@ LIBS="${HDF5_LIBS:-$LIBSBASE}"
+ # available library is shared, it will be used by default.  The user can
+ # override either default, although choosing an unavailable library will result
+ # in link errors.
+-STATIC_AVAILABLE="@enable_static@"
++# Fedora prefers shared libraries
++STATIC_AVAILABLE=no
+ if test "${STATIC_AVAILABLE}" = "yes"; then
+   USE_SHARED_LIB="${HDF5_USE_SHLIB:-no}"
+ else
+@@ -387,7 +388,7 @@ if test "x$do_link" = "xyes"; then
+   # from the hdf5 build. The order of the flags is intended to give precedence
+   # to the user's flags.
+ 
+-  $SHOW $CXXLINKER $H5BLD_CPPFLAGS $CPPFLAGS $H5BLD_CXXFLAGS $CXXFLAGS $LDFLAGS $clibpath $link_objs $LIBS $link_args $shared_link
++  $SHOW $CXXLINKER $H5BLD_CPPFLAGS $CPPFLAGS $H5BLD_CXXFLAGS $CXXFLAGS $LDFLAGS $clibpath $link_objs $LIBS $link_args
+ 
+   status=$?
+ fi
+diff -up hdf5-1.8.12/fortran/src/h5fc.in.wrappers hdf5-1.8.12/fortran/src/h5fc.in
+--- hdf5-1.8.12/fortran/src/h5fc.in.wrappers	2013-11-21 08:14:04.000000000 -0700
++++ hdf5-1.8.12/fortran/src/h5fc.in	2021-09-15 20:14:40.123641057 -0600
+@@ -85,11 +85,11 @@ FLINKERBASE="@FC@"
+ # libraries in $link_args, followed by any external library paths and libraries 
+ # from AM_LDFLAGS, LDFLAGS, AM_LIBS or LIBS carried in from the hdf5 build.
+ # The order of the flags is intended to give precedence to the user's flags.
+-H5BLD_FCFLAGS="@AM_FCFLAGS@ @FCFLAGS@"
++H5BLD_FCFLAGS=
+ F9XMODFLAG="@F9XMODFLAG@"
+ F9XSUFFIXFLAG="@F9XSUFFIXFLAG@"
+-H5BLD_LDFLAGS="@AM_LDFLAGS@ @LDFLAGS@"
+-H5BLD_LIBS="@LIBS@"
++H5BLD_LDFLAGS=
++H5BLD_LIBS=
+ 
+ FC="${HDF5_FC:-$FCBASE}"
+ FLINKER="${HDF5_FLINKER:-$FLINKERBASE}"
+@@ -101,7 +101,8 @@ LIBS="${HDF5_LIBS:-$LIBSBASE}"
+ # available library is shared, it will be used by default.  The user can
+ # override either default, although choosing an unavailable library will result
+ # in link errors.
+-STATIC_AVAILABLE="@enable_static@"
++# Fedora prefers shared libraries
++STATIC_AVAILABLE=no
+ if test "${STATIC_AVAILABLE}" = "yes"; then
+   USE_SHARED_LIB="${HDF5_USE_SHLIB:-no}"
+ else
+@@ -365,7 +366,7 @@ if test "x$do_link" = "xyes"; then
+   # libraries in $link_args, followed by any external library paths and libraries 
+   # from AM_LDFLAGS, LDFLAGS, AM_LIBS or LIBS carried in from the hdf5 build.
+   # The order of the flags is intended to give precedence to the user's flags.
+-  $SHOW $FLINKER $FCFLAGS $H5BLD_FCFLAGS $F9XSUFFIXFLAG $LDFLAGS $fmodules $link_objs $LIBS $link_args $shared_link
++  $SHOW $FLINKER $FCFLAGS $H5BLD_FCFLAGS $F9XSUFFIXFLAG $LDFLAGS $fmodules $link_objs $LIBS $link_args
+   status=$?
+ fi
+ 
+diff -up hdf5-1.8.12/tools/misc/h5cc.in.wrappers hdf5-1.8.12/tools/misc/h5cc.in
+--- hdf5-1.8.12/tools/misc/h5cc.in.wrappers	2013-11-21 08:13:59.000000000 -0700
++++ hdf5-1.8.12/tools/misc/h5cc.in	2021-09-15 20:14:40.123641057 -0600
+@@ -91,10 +91,10 @@ CLINKERBASE="@CC@"
+ # paths and libraries from AM_LDFLAGS, LDFLAGS, AM_LIBS or LIBS carried in 
+ # from the hdf5 build. The order of the flags is intended to give precedence
+ # to the user's flags.
+-H5BLD_CFLAGS="@AM_CFLAGS@ @CFLAGS@"
++H5BLD_CFLAGS=
+ H5BLD_CPPFLAGS="@AM_CPPFLAGS@ @CPPFLAGS@"
+-H5BLD_LDFLAGS="@AM_LDFLAGS@ @LDFLAGS@"
+-H5BLD_LIBS="@LIBS@"
++H5BLD_LDFLAGS=
++H5BLD_LIBS=
+ 
+ CC="${HDF5_CC:-$CCBASE}"
+ CLINKER="${HDF5_CLINKER:-$CLINKERBASE}"
+@@ -107,7 +107,8 @@ LIBS="${HDF5_LIBS:-$LIBSBASE}"
+ # available library is shared, it will be used by default.  The user can 
+ # override either default, although choosing an unavailable library will result
+ # in link errors.  
+-STATIC_AVAILABLE="@enable_static@"
++# Fedora prefers shared libraries
++STATIC_AVAILABLE=no
+ if test "${STATIC_AVAILABLE}" = "yes"; then
+   USE_SHARED_LIB="${HDF5_USE_SHLIB:-no}"
+ else
+@@ -394,7 +395,7 @@ if test "x$do_link" = "xyes"; then
+   # paths and libraries from AM_LDFLAGS, LDFLAGS, AM_LIBS or LIBS carried in 
+   # from the hdf5 build. The order of the flags is intended to give precedence
+   # to the user's flags.
+-  $SHOW $CLINKER $H5BLD_CPPFLAGS $CPPFLAGS $H5BLD_CFLAGS $CFLAGS $LDFLAGS $clibpath $link_objs $LIBS $link_args $shared_link
++  $SHOW $CLINKER $H5BLD_CPPFLAGS $CPPFLAGS $H5BLD_CFLAGS $CFLAGS $LDFLAGS $clibpath $link_objs $LIBS $link_args
+   status=$?
+ fi
+ 
diff --git a/hdf5.spec b/hdf5.spec
index b9bbbe6..1b92f69 100644
--- a/hdf5.spec
+++ b/hdf5.spec
@@ -7,7 +7,7 @@
 # You need to recompile all users of HDF5 for each version change
 Name: hdf5
 Version: 1.8.12
-Release: 6%{?dist}
+Release: 13%{?dist}
 Summary: A general purpose library and file format for storing scientific data
 License: BSD
 Group: System Environment/Libraries
@@ -26,6 +26,11 @@ Patch2: hdf5-aarch64.patch
 Patch3: hdf5-ldouble-ppc64le.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1080122
 Patch4: hdf5-ppc64le.patch
+# Upstream patch for various Talos CVEs
+Patch5: https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.8/talospatch/hdf51.8-CVE2016.patch
+# Remove Fedora build flags from h5cc/h5c++/h5fc
+# https://bugzilla.redhat.com/show_bug.cgi?id=1794625
+Patch6: hdf5-wrappers.patch
 
 BuildRequires: krb5-devel, openssl-devel, zlib-devel, gcc-gfortran, time
 # For patches/rpath
@@ -33,18 +38,16 @@ BuildRequires: automake
 BuildRequires: libtool
 # Needed for mpi tests
 BuildRequires: openssh-clients
+BuildRequires: libaec-devel
 
 %global with_mpich 1
 %global with_openmpi 1
-%if 0%{?rhel}
+
 %ifarch ppc64
-# No mpich2 on ppc64 in EL
-%global with_mpich 0
-%endif
-%endif
-%ifarch s390 s390x
-# No openmpi on s390(x)
-%global with_openmpi 0
+# No openmpi3 on ppc64
+%global with_openmpi3 0
+%else
+%global with_openmpi3 1
 %endif
 
 %if %{with_mpich}
@@ -53,6 +56,9 @@ BuildRequires: openssh-clients
 %if %{with_openmpi}
 %global mpi_list %{?mpi_list} openmpi
 %endif
+%if 0%{?with_openmpi3}
+%global mpi_list %{?mpi_list} openmpi3
+%endif
 
 %description
 HDF5 is a general purpose library and file format for storing scientific data.
@@ -68,7 +74,8 @@ grids. You can also mix and match them in HDF5 files according to your needs.
 Summary: HDF5 development files
 Group: Development/Libraries
 Requires: %{name} = %{version}-%{release}
-Requires: zlib-devel
+Requires: libaec-devel%{?_isa}
+Requires: zlib-devel%{?_isa}
 
 %description devel
 HDF5 development headers and libraries.
@@ -89,7 +96,6 @@ Summary: HDF5 mpich libraries
 Group: Development/Libraries
 Requires: mpich
 BuildRequires: mpich-devel
-Provides: %{name}-mpich2 = %{version}-%{release}
 Obsoletes: %{name}-mpich2 < 1.8.11-4
 
 %description mpich
@@ -100,7 +106,10 @@ HDF5 parallel mpich libraries
 Summary: HDF5 mpich development files
 Group: Development/Libraries
 Requires: %{name}-mpich%{?_isa} = %{version}-%{release}
-Requires: mpich
+Requires: libaec-devel%{?_isa}
+Requires: zlib-devel%{?_isa}
+# RHEL doesn't provide with %{_isa}
+Requires: mpich-devel
 Provides: %{name}-mpich2-devel = %{version}-%{release}
 Obsoletes: %{name}-mpich2-devel < 1.8.11-4
 
@@ -135,7 +144,9 @@ HDF5 parallel openmpi libraries
 Summary: HDF5 openmpi development files
 Group: Development/Libraries
 Requires: %{name}-openmpi%{_isa} = %{version}-%{release}
-Requires: openmpi-devel
+Requires: libaec-devel%{?_isa}
+Requires: zlib-devel%{?_isa}
+Requires: openmpi-devel%{?_isa}
 
 %description openmpi-devel
 HDF5 parallel openmpi development files
@@ -148,6 +159,38 @@ Requires: %{name}-openmpi-devel%{?_isa} = %{version}-%{release}
 
 %description openmpi-static
 HDF5 parallel openmpi static libraries
+
+%if 0%{?with_openmpi3}
+%package openmpi3
+Summary: HDF5 openmpi3 libraries
+Group: Development/Libraries
+Requires: openmpi3
+BuildRequires: openmpi3-devel
+
+%description openmpi3
+HDF5 parallel openmpi3 libraries
+
+
+%package openmpi3-devel
+Summary: HDF5 openmpi3 development files
+Group: Development/Libraries
+Requires: %{name}-openmpi3%{_isa} = %{version}-%{release}
+Requires: libaec-devel%{?_isa}
+Requires: zlib-devel%{?_isa}
+Requires: openmpi3-devel%{?_isa}
+
+%description openmpi3-devel
+HDF5 parallel openmpi3 development files
+
+
+%package openmpi3-static
+Summary: HDF5 openmpi3 static libraries
+Group: Development/Libraries
+Requires: %{name}-openmpi3-devel%{?_isa} = %{version}-%{release}
+
+%description openmpi3-static
+HDF5 parallel openmpi3 static libraries
+%endif
 %endif
 
 
@@ -162,6 +205,8 @@ HDF5 parallel openmpi static libraries
 %patch2 -p1 -b .aarch64
 %patch3 -p1 -b .ldouble-ppc64le
 %patch4 -p1 -b .ppc64le
+%patch5 -p0 -b .CVE
+%patch6 -p1 -b .wrappers
 #This should be fixed in 1.8.7
 find \( -name '*.[ch]*' -o -name '*.f90' -o -name '*.txt' \) -exec chmod -x {} +
 autoreconf -f -i
@@ -177,6 +222,7 @@ autoreconf -f -i
   --enable-fortran2003 \\\
   --enable-hl \\\
   --enable-shared \\\
+  --with-szlib \\\
 %{nil}
 # --enable-cxx and --enable-parallel flags are incompatible
 # --with-mpe=DIR          Use MPE instrumentation [default=no]
@@ -186,20 +232,21 @@ autoreconf -f -i
 export CC=gcc
 export CXX=g++
 export F9X=gfortran
-export CFLAGS="${RPM_OPT_FLAGS/O2/O0}"
 mkdir build
 pushd build
 ln -s ../configure .
 %configure \
   %{configure_opts} \
   --enable-cxx
-make
+make %{?_smp_mflags}
 popd
 
 #MPI builds
 export CC=mpicc
 export CXX=mpicxx
 export F9X=mpif90
+# Work around a bug in mpich when hostname is not resovable
+export RUNPARALLEL="mpiexec -np 4 -host localhost"
 for mpi in %{mpi_list}
 do
   mkdir $mpi
@@ -215,7 +262,7 @@ do
     --includedir=%{_includedir}/$mpi-%{_arch} \
     --datarootdir=%{_libdir}/$mpi/share \
     --mandir=%{_libdir}/$mpi/share/man
-  make
+  make %{?_smp_mflags}
   module purge
   popd
 done
@@ -273,6 +320,8 @@ cp -p debian/man/*.1 ${RPM_BUILD_ROOT}%{_mandir}/man1/
 
 %check
 make -C build check
+# Limit to 4 processors to try to avoid oversubscribing
+export NPROCS=4
 # disable parallel tests on s390(x) - something gets wrong in DNS resolver in glibc
 # they are passed when run manually in mock
 %ifnarch s390 s390x
@@ -412,19 +461,75 @@ done
 
 %files openmpi-static
 %{_libdir}/openmpi/lib/*.a
+
+%if 0%{?with_openmpi3}
+%files openmpi3
+%doc COPYING MANIFEST README.txt release_docs/RELEASE.txt
+%doc release_docs/HISTORY*.txt
+%{_libdir}/openmpi3/bin/gif2h5
+%{_libdir}/openmpi3/bin/h52gif
+%{_libdir}/openmpi3/bin/h5copy
+%{_libdir}/openmpi3/bin/h5debug
+%{_libdir}/openmpi3/bin/h5diff
+%{_libdir}/openmpi3/bin/h5dump
+%{_libdir}/openmpi3/bin/h5import
+%{_libdir}/openmpi3/bin/h5jam
+%{_libdir}/openmpi3/bin/h5ls
+%{_libdir}/openmpi3/bin/h5mkgrp
+%{_libdir}/openmpi3/bin/h5perf
+%{_libdir}/openmpi3/bin/h5perf_serial
+%{_libdir}/openmpi3/bin/h5redeploy
+%{_libdir}/openmpi3/bin/h5repack
+%{_libdir}/openmpi3/bin/h5repart
+%{_libdir}/openmpi3/bin/h5stat
+%{_libdir}/openmpi3/bin/h5unjam
+%{_libdir}/openmpi3/bin/ph5diff
+%{_libdir}/openmpi3/lib/*.so.*
+
+%files openmpi3-devel
+%{_includedir}/openmpi3-%{_arch}
+%{_libdir}/openmpi3/bin/h5pcc
+%{_libdir}/openmpi3/bin/h5pfc
+%{_libdir}/openmpi3/lib/lib*.so
+%{_libdir}/openmpi3/lib/lib*.settings
+
+%files openmpi3-static
+%{_libdir}/openmpi3/lib/*.a
+%endif
 %endif
 
 
 %changelog
-* Mon Mar 24 2014 Orion Poplawski <orion@cora.nwra.com> - 1.8.12-6
-- Add patch to add ppc64le to config.guess (bug #1080122)
+* Wed Sep 15 2021 Orion Poplawski <orion@nwra.com> - 1.8.12-13
+- Remove Fedora build flags from h5cc/h5c++/h5fc (bz#1980549)
 
-* Wed Mar 19 2014 Orion Poplawski <orion@cora.nwra.com> - 1.8.12-5
+* Tue Jan 26 2021 Orion Poplawski <orion@nwra.com> - 1.8.12-12
+- Drop compiling with -O0
+
+* Sun Apr 28 2019 Dave Love <loveshack@fedoraproject.org> - 1.8.12-11
+- Build an openmpi3 version on el7
+
+* Tue Aug 22 2017 Orion Poplawski <orion@nwra.com> - 1.8.12-10
+- RHEL doesn't provide mpich-devel%%{_isa}
+
+* Tue Aug 15 2017 Christoph Junghans <junghans@votca.org> - 1.8.12-9
+- enable szip support through libaec
+
+* Thu Dec 15 2016 Orion Poplawski <orion@cora.nwra.com> - 1.8.12-8
+- Add upstream patch to fix various Talos CVEs (bug #1397716)
+
+* Wed Dec 9 2015 Orion Poplawski <orion@cora.nwra.com> - 1.8.12-7
+- Rebuild with openmpi 1.10.0 (bug #1290286)
+
+* Wed Mar 4 2015 Orion Poplawski <orion@cora.nwra.com> - 1.8.12-6
+- Add patch to add ppc64le to config.guess (bug #1080122)
 - Add patch to fix long double conversions on ppc64le (bug #1078173)
 - Run autoreconf for patches and to remove rpaths
 
-* Sat Feb 22 2014 Deji Akingunola <dakingun@gmail.com> - 1.8.12-4
-- Rebuild for mpich-3.1
+* Tue Feb 4 2014 Orion Poplawski <orion@cora.nwra.com> 1.8.12-5
+- Use parallel make
+- Limit number of processors to 4 in parallel tests to avoid mpich issue with
+  oversubscription
 
 * Fri Jan 31 2014 Orion Poplawski <orion@cora.nwra.com> 1.8.12-4
 - Fix rpm macros install dir
diff --git a/hdf51.8-CVE2016.patch b/hdf51.8-CVE2016.patch
new file mode 100644
index 0000000..da34e62
--- /dev/null
+++ b/hdf51.8-CVE2016.patch
@@ -0,0 +1,280 @@
+diff --git src/H5Ocache.c src/H5Ocache.c
+index 9057223..2aaf933 100644
+--- src/H5Ocache.c
++++ src/H5Ocache.c
+@@ -1134,6 +1134,10 @@ H5O_chunk_deserialize(H5O_t *oh, haddr_t addr, size_t len, const uint8_t *image,
+             HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL, "bad flag combination for message")
+         if((flags & H5O_MSG_FLAG_WAS_UNKNOWN) && !(flags & H5O_MSG_FLAG_MARK_IF_UNKNOWN))
+             HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL, "bad flag combination for message")
++        if((flags & H5O_MSG_FLAG_SHAREABLE)
++                && H5O_msg_class_g[id]
++                && !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
++            HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL, "message of unsharable class flagged as sharable")
+ 
+         /* Reserved bytes/creation index */
+         if(oh->version == H5O_VERSION_1)
+diff --git src/H5Odtype.c src/H5Odtype.c
+index 622a18e..67f2fca 100644
+--- src/H5Odtype.c
++++ src/H5Odtype.c
+@@ -310,7 +310,11 @@ H5O_dtype_decode_helper(H5F_t *f, unsigned *ioflags/*in,out*/, const uint8_t **p
+                     if(version == H5O_DTYPE_VERSION_1) {
+                         /* Decode the number of dimensions */
+                         ndims = *(*pp)++;
+-                        HDassert(ndims <= 4);
++
++                        /* Check that ndims is valid */
++                        if(ndims > 4)
++                            HGOTO_ERROR(H5E_DATATYPE, H5E_BADTYPE, FAIL, "invalid number of dimensions for array")
++
+                         *pp += 3;		/*reserved bytes */
+ 
+                         /* Skip dimension permutation */
+@@ -518,7 +522,8 @@ H5O_dtype_decode_helper(H5F_t *f, unsigned *ioflags/*in,out*/, const uint8_t **p
+             dt->shared->u.array.ndims = *(*pp)++;
+ 
+             /* Double-check the number of dimensions */
+-            HDassert(dt->shared->u.array.ndims <= H5S_MAX_RANK);
++            if(dt->shared->u.array.ndims > H5S_MAX_RANK)
++                HGOTO_ERROR(H5E_DATATYPE, H5E_CANTLOAD, FAIL, "too many dimensions for array datatype")
+ 
+             /* Skip reserved bytes, if version has them */
+             if(version < H5O_DTYPE_VERSION_3)
+diff --git src/H5Opkg.h src/H5Opkg.h
+index ff52537..2c8c5a0 100644
+--- src/H5Opkg.h
++++ src/H5Opkg.h
+@@ -201,6 +201,7 @@
+                                                                               \
+         /* Set the message's "shared info", if it's shareable */	      \
+         if((MSG)->flags & H5O_MSG_FLAG_SHAREABLE) {                           \
++            HDassert(msg_type->share_flags & H5O_SHARE_IS_SHARABLE);          \
+             H5O_UPDATE_SHARED((H5O_shared_t *)(MSG)->native, H5O_SHARE_TYPE_HERE, (F), msg_type->id, (MSG)->crt_idx, (OH)->chunk[0].addr) \
+         } /* end if */                                                        \
+                                                                               \
+diff --git src/H5Znbit.c src/H5Znbit.c
+index 38610b6..ddcf8fd 100644
+--- src/H5Znbit.c
++++ src/H5Znbit.c
+@@ -60,11 +60,11 @@ static void H5Z_nbit_decompress_one_nooptype(unsigned char *data, size_t data_of
+                        unsigned char *buffer, size_t *j, int *buf_len, unsigned size);
+ static void H5Z_nbit_decompress_one_atomic(unsigned char *data, size_t data_offset,
+                     unsigned char *buffer, size_t *j, int *buf_len, parms_atomic p);
+-static void H5Z_nbit_decompress_one_array(unsigned char *data, size_t data_offset,
++static herr_t H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset,
+            unsigned char *buffer, size_t *j, int *buf_len, const unsigned parms[]);
+-static void H5Z_nbit_decompress_one_compound(unsigned char *data, size_t data_offset,
++static herr_t H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset,
+               unsigned char *buffer, size_t *j, int *buf_len, const unsigned parms[]);
+-static void H5Z_nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer,
++static herr_t H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer,
+                                 const unsigned parms[]);
+ static void H5Z_nbit_compress_one_nooptype(unsigned char *data, size_t data_offset,
+                      unsigned char *buffer, size_t *j, int *buf_len, unsigned size);
+@@ -897,7 +897,8 @@ H5Z_filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[],
+             HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "memory allocation failed for nbit decompression")
+ 
+         /* decompress the buffer */
+-        H5Z_nbit_decompress(outbuf, d_nelmts, (unsigned char *)*buf, cd_values);
++        if(H5Z__nbit_decompress(outbuf, d_nelmts, (unsigned char *)*buf, cd_values) < 0)
++            HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, 0, "can't decompress buffer")
+     } /* end if */
+     /* output; compress */
+     else {
+@@ -1046,12 +1047,15 @@ H5Z_nbit_decompress_one_atomic(unsigned char *data, size_t data_offset,
+    }
+ }
+ 
+-static void
+-H5Z_nbit_decompress_one_array(unsigned char *data, size_t data_offset,
++static herr_t
++H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset,
+            unsigned char *buffer, size_t *j, int *buf_len, const unsigned parms[])
+ {
+    unsigned i, total_size, base_class, base_size, n, begin_index;
+    parms_atomic p;
++   herr_t ret_value = SUCCEED; /* Return value */
++
++   FUNC_ENTER_STATIC
+ 
+    total_size = parms[parms_index++];
+    base_class = parms[parms_index++];
+@@ -1062,7 +1066,12 @@ H5Z_nbit_decompress_one_array(unsigned char *data, size_t data_offset,
+            p.order = parms[parms_index++];
+            p.precision = parms[parms_index++];
+            p.offset = parms[parms_index++];
+-           n = total_size/p.size;
++
++           /* Check values of precision and offset */
++           if(p.precision > p.size * 8 || (p.precision + p.offset) > p.size * 8)
++              HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset")
++
++           n = total_size / p.size;
+            for(i = 0; i < n; i++)
+               H5Z_nbit_decompress_one_atomic(data, data_offset + i*p.size,
+                                              buffer, j, buf_len, p);
+@@ -1072,8 +1081,9 @@ H5Z_nbit_decompress_one_array(unsigned char *data, size_t data_offset,
+            n = total_size/base_size; /* number of base_type elements inside the array datatype */
+            begin_index = parms_index;
+            for(i = 0; i < n; i++) {
+-              H5Z_nbit_decompress_one_array(data, data_offset + i*base_size,
+-                                            buffer, j, buf_len, parms);
++              if(H5Z__nbit_decompress_one_array(data, data_offset + i * base_size,
++                                            buffer, j, buf_len, parms) < 0)
++                 HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array")
+               parms_index = begin_index;
+            }
+            break;
+@@ -1082,8 +1092,9 @@ H5Z_nbit_decompress_one_array(unsigned char *data, size_t data_offset,
+            n = total_size/base_size; /* number of base_type elements inside the array datatype */
+            begin_index = parms_index;
+            for(i = 0; i < n; i++) {
+-              H5Z_nbit_decompress_one_compound(data, data_offset + i*base_size,
+-                                               buffer, j, buf_len, parms);
++              if(H5Z__nbit_decompress_one_compound(data, data_offset + i * base_size,
++                                               buffer, j, buf_len, parms) < 0)
++                 HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound")
+               parms_index = begin_index;
+            }
+            break;
+@@ -1094,51 +1105,76 @@ H5Z_nbit_decompress_one_array(unsigned char *data, size_t data_offset,
+       default:
+           HDassert(0 && "This Should never be executed!");
+    } /* end switch */
++
++done:
++    FUNC_LEAVE_NOAPI(ret_value)
+ }
+ 
+-static void
+-H5Z_nbit_decompress_one_compound(unsigned char *data, size_t data_offset,
++static herr_t
++H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset,
+               unsigned char *buffer, size_t *j, int *buf_len, const unsigned parms[])
+ {
+-   unsigned i, nmembers, member_offset, member_class, size;
++   unsigned i, nmembers, member_offset, member_class, member_size, used_size = 0, size;
+    parms_atomic p;
++   herr_t ret_value = SUCCEED; /* Return value */
+ 
+-   parms_index++; /* skip total size of compound datatype */
++   FUNC_ENTER_STATIC
++
++   size = parms[parms_index++];
+    nmembers = parms[parms_index++];
+ 
+    for(i = 0; i < nmembers; i++) {
+       member_offset = parms[parms_index++];
+       member_class = parms[parms_index++];
++
++      /* Check for overflow */
++      member_size = parms[parms_index];
++      used_size += member_size;
++      if(used_size > size)
++         HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "compound member offset overflowed compound size")
+       switch(member_class) {
+          case H5Z_NBIT_ATOMIC:
+-              p.size = parms[parms_index++];
++              p.size = member_size;
++              /* Advance past member size */
++              parms_index++;
+               p.order = parms[parms_index++];
+               p.precision = parms[parms_index++];
+               p.offset = parms[parms_index++];
++
++              /* Check values of precision and offset */
++              if(p.precision > p.size * 8 || (p.precision + p.offset) > p.size * 8)
++                 HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset")
++
+               H5Z_nbit_decompress_one_atomic(data, data_offset + member_offset,
+                                              buffer, j, buf_len, p);
+               break;
+          case H5Z_NBIT_ARRAY:
+-              H5Z_nbit_decompress_one_array(data, data_offset + member_offset,
+-                                            buffer, j, buf_len, parms);
++              if(H5Z__nbit_decompress_one_array(data, data_offset + member_offset,
++                                            buffer, j, buf_len, parms) < 0)
++                 HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array")
+               break;
+          case H5Z_NBIT_COMPOUND:
+-              H5Z_nbit_decompress_one_compound(data, data_offset+member_offset,
+-                                               buffer, j, buf_len, parms);
++              if(H5Z__nbit_decompress_one_compound(data, data_offset+member_offset,
++                                            buffer, j, buf_len, parms) < 0)
++                 HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound")
+               break;
+          case H5Z_NBIT_NOOPTYPE:
+-              size = parms[parms_index++];
++              /* Advance past member size */
++              parms_index++;
+               H5Z_nbit_decompress_one_nooptype(data, data_offset+member_offset,
+-                                               buffer, j, buf_len, size);
++                                               buffer, j, buf_len, member_size);
+               break;
+           default:
+               HDassert(0 && "This Should never be executed!");
+       } /* end switch */
+    }
++
++done:
++    FUNC_LEAVE_NOAPI(ret_value)
+ }
+ 
+-static void
+-H5Z_nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer,
++static herr_t
++H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer,
+                                 const unsigned parms[])
+ {
+    /* i: index of data, j: index of buffer,
+@@ -1146,6 +1182,9 @@ H5Z_nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffe
+    size_t i, j, size;
+    int buf_len;
+    parms_atomic p;
++   herr_t ret_value = SUCCEED; /* Return value */
++
++   FUNC_ENTER_STATIC
+ 
+    /* may not have to initialize to zeros */
+    for(i = 0; i < d_nelmts*parms[4]; i++) data[i] = 0;
+@@ -1161,6 +1200,11 @@ H5Z_nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffe
+            p.order = parms[5];
+            p.precision = parms[6];
+            p.offset = parms[7];
++
++           /* Check values of precision and offset */
++           if(p.precision > p.size * 8 || (p.precision + p.offset) > p.size * 8)
++              HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset")
++
+            for(i = 0; i < d_nelmts; i++) {
+               H5Z_nbit_decompress_one_atomic(data, i*p.size, buffer, &j, &buf_len, p);
+            }
+@@ -1169,7 +1213,8 @@ H5Z_nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffe
+            size = parms[4];
+            parms_index = 4;
+            for(i = 0; i < d_nelmts; i++) {
+-              H5Z_nbit_decompress_one_array(data, i*size, buffer, &j, &buf_len, parms);
++              if(H5Z__nbit_decompress_one_array(data, i*size, buffer, &j, &buf_len, parms) < 0)
++                 HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array")
+               parms_index = 4;
+            }
+            break;
+@@ -1177,13 +1222,17 @@ H5Z_nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffe
+            size = parms[4];
+            parms_index = 4;
+            for(i = 0; i < d_nelmts; i++) {
+-              H5Z_nbit_decompress_one_compound(data, i*size, buffer, &j, &buf_len, parms);
++              if(H5Z__nbit_decompress_one_compound(data, i*size, buffer, &j, &buf_len, parms) < 0)
++                 HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound")
+               parms_index = 4;
+            }
+            break;
+       default:
+           HDassert(0 && "This Should never be executed!");
+    } /* end switch */
++
++done:
++    FUNC_LEAVE_NOAPI(ret_value)
+ }
+ 
+ static void H5Z_nbit_compress_one_byte(unsigned char *data, size_t data_offset, int k, int begin_i,